3.18-stable patches

added patches:
	kvm-fix-page-struct-leak-in-handle_vmon.patch
	revert-arm-8457-1-psci-smp-is-built-only-for-smp.patch

diff --git a/queue-3.18/kvm-fix-page-struct-leak-in-handle_vmon.patch b/queue-3.18/kvm-fix-page-struct-leak-in-handle_vmon.patch
new file mode 100644 (file)
index 0000000..5c73155
--- /dev/null
+++ b/queue-3.18/kvm-fix-page-struct-leak-in-handle_vmon.patch
@@ -0,0 +1,48 @@
+From 06ce521af9558814b8606c0476c54497cf83a653 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 24 Jan 2017 11:56:21 +0100
+Subject: kvm: fix page struct leak in handle_vmon
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+commit 06ce521af9558814b8606c0476c54497cf83a653 upstream.
+
+handle_vmon gets a reference on VMXON region page,
+but does not release it. Release the reference.
+
+Found by syzkaller; based on a patch by Dmitry.
+
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+[bwh: Backported to 3.16: use skip_emulated_instruction()]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/vmx.c |   10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -6079,14 +6079,20 @@ static int nested_vmx_check_vmptr(struct
+               }
+ 
+               page = nested_get_page(vcpu, vmptr);
+-              if (page == NULL ||
+-                  *(u32 *)kmap(page) != VMCS12_REVISION) {
++              if (page == NULL) {
+                       nested_vmx_failInvalid(vcpu);
++                      skip_emulated_instruction(vcpu);
++                      return 1;
++              }
++              if (*(u32 *)kmap(page) != VMCS12_REVISION) {
+                       kunmap(page);
++                      nested_release_page_clean(page);
++                      nested_vmx_failInvalid(vcpu);
+                       skip_emulated_instruction(vcpu);
+                       return 1;
+               }
+               kunmap(page);
++              nested_release_page_clean(page);
+               vmx->nested.vmxon_ptr = vmptr;
+               break;
+       case EXIT_REASON_VMCLEAR:

diff --git a/queue-3.18/revert-arm-8457-1-psci-smp-is-built-only-for-smp.patch b/queue-3.18/revert-arm-8457-1-psci-smp-is-built-only-for-smp.patch
new file mode 100644 (file)
index 0000000..243d1cc
--- /dev/null
+++ b/queue-3.18/revert-arm-8457-1-psci-smp-is-built-only-for-smp.patch
@@ -0,0 +1,39 @@
+From amit.pundir@linaro.org  Tue Apr 18 16:20:49 2017
+From: Amit Pundir <amit.pundir@linaro.org>
+Date: Thu,  6 Apr 2017 11:37:14 +0530
+Subject: Revert "ARM: 8457/1: psci-smp is built only for SMP"
+To: stable@vger.kernel.org
+Cc: gregkh@linuxfoundation.org
+Message-ID: <1491458834-28498-1-git-send-email-amit.pundir@linaro.org>
+
+From: Amit Pundir <amit.pundir@linaro.org>
+
+This reverts commit dbcfee724255ae171af51aaa56d8c5b78342adc9 which is
+commit be95485a0b8288a93402705730d3ea32f9f812b9 upstream.
+
+Upstream commit be95485 (ARM: 8457/1: psci-smp is built only for SMP)
+was intended to fix the build error for configs with CONFIG_SMP=n and
+CONFIG_ARM_PSCI=y, but it end up introducing a build error when
+cherry-picked on 3.18.y.
+
+This patch resulted in redefinition of psci_init() and broke the
+build for every build config in 3.18.y with CONFIG_SMP=n and
+CONFIG_ARM_PSCI=y.
+
+Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/include/asm/psci.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/include/asm/psci.h
++++ b/arch/arm/include/asm/psci.h
+@@ -37,7 +37,7 @@ struct psci_operations {
+ extern struct psci_operations psci_ops;
+ extern struct smp_operations psci_smp_ops;
+ 
+-#if defined(CONFIG_SMP) && defined(CONFIG_ARM_PSCI)
++#ifdef CONFIG_ARM_PSCI
+ int psci_init(void);
+ bool psci_smp_available(void);
+ #else

diff --git a/queue-3.18/series b/queue-3.18/series
index 2fe274b82fe274c4ff6c274f483156d0d12e5075..88dd3e349baee29d023e7355303b1d2facb02353 100644 (file)
--- a/queue-3.18/series
+++ b/queue-3.18/series
@@ -12,3 +12,5 @@ xen-fbfront-fix-connecting-to-backend.patch
 ftrace-fix-removing-of-second-function-probe.patch
 char-drop-bogus-dependency-of-devport-on-m68k.patch
 char-lack-of-bool-string-made-config_devport-always-on.patch
+revert-arm-8457-1-psci-smp-is-built-only-for-smp.patch
+kvm-fix-page-struct-leak-in-handle_vmon.patch